Threat Intelligence Bulletin: 01/20/2023 - 01/26/2023

Password Management Woes Continue

Product Serial: F-2023-01-20a

TLP:CLEAR

In this flash report, ZeroFox Intelligence provides updates on another password manager being impacted by breach activity.

Standing Intelligence Requirements

Compromised Account Credentials, Compromise Impacts, Breach

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 10:00 AM (EST) on January 20, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

• The company behind Norton LifeLock has indicated that threat actors gained access to hundreds of thousands of customer accounts using credential stuffing.
• This breach differs from the LastPass breach in that the organization itself was not compromised, although a subset of accounts using the Norton Password Manager feature were accessed.
• Users should update their passwords and avoid password reuse for multiple accounts.

Breach Disclosure: Locally

An alleged data breach at Locally, a U.S.-based online-to-offline shopping solution provider, exposed 1,465,420 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Locally, a U.S.-based online-to-offline shopping solution provider, allegedly suffered a security incident, in which 1,465,420 email addresses and/or usernames were leaked, which were subsequently shared on a deep web platform. Of these, an assessed 56,021 records were successfully linked to hashed passwords. Other notable information leaked in this package include name, phone number, card number and physical address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: Lordhair

An alleged data breach at Lordhair, a China-based company that designs and ships non-surgical hair replacement systems, exposed 24,890 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Lordhair, a China-based company that designs and ships non-surgical hair replacement systems, allegedly suffered a security incident, in which 24,890 email addresses and/or usernames were leaked, which were subsequently shared on a deep web platform. No passwords were found in this breach. Other notable information leaked in this package include name and physical address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breach Disclosure: TDTprofesional

An alleged data breach at TDTprofesional, a Spain-based online and offline store for DTT and satellite equipments, exposed 32,134 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

Indolj, a Spain-based online and offline store for DTT and satellite equipments, allegedly suffered a security incident, in which 32,134 email addresses and/or usernames were leaked, which were subsequently shared on a deep web platform. Other notable information leaked in this package include name, phone number, date of birth, fax number, and physical address. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

The Underground Economist: Volume 3, Issue 2

Welcome back to The Underground Economist, Volume 3, Issue 2, an intelligence focused blog series illuminating Dark Web findings in digestible tidbits from our ZeroFox Dark Ops intelligence team. The Dark Ops team scours the Dark Web, extending visibility and engagement into places traditional security teams can’t reach to share meaningful and insightful intelligence on the trends and tactics threat actors are leveraging across the Dark Web and criminal underground. Here’s the latest for the week of January 20, 2023.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full piece here.

Blockchains and Transparency in Food Retail

Product Serial: B-2023-01-24a

TLP:CLEAR

In this brief, ZeroFox Intelligence provides an analysis on the use of blockchain technology to provide transparency in food retail.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EST) on January 3, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

At a time when higher levels of transparency are expected by governments and much of the public, blockchain technology provides an attractive solution for food retail enterprises with global reach to account for their many suppliers and the potential impacts of related dealings. When effectively harnessed, this technology can create an accessible, comprehensive record of the conditions in which products have been sourced. Such a record can also facilitate timely remedial action by highlighting cases in which safety, the public good, or the health of the enterprise itself have been compromised. Additionally, mechanisms known as smart contracts can potentially be incorporated into blockchains to facilitate the enforcement of an enterprise’s requirements of other supply chain participants.

ZeroFox Intelligence 2022 Conclusions / 2023 Forecast

TLP:CLEAR

In this assessment, ZeroFox Intelligence provides a review of 2022 cyber and physical security activity, and a forecast of 2023 activity.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Breach Disclosure: 여행노트 (Travel Note)

An alleged data breach at 여행노트 - Travel Note, a South Korea-based travel platform, exposed 111,309 email addresses and/or usernames, which were subsequently shared on a deep web platform.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Details

여행노트 - Travel Note, a South Korea-based travel platform, allegedly suffered a security incident, in which 111,309 email addresses and/or usernames were leaked, which were subsequently shared on a deep web platform. Of these, 81,162 records were successfully linked to hashed passwords. Other notable information leaked in this package includes name, phone numbers, user gender, date of birth, physical addresses, and device information. The threat actor did not disclose the ultimate source of the data breach or how it was exploited.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFox recommends immediate password changes for the affected account
• Enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Breaking News: 2023-01-20 - 2023-01-26

New "Blank Image" attack hides phishing scripts in SVG files

An unusual phishing technique has been observed in the wild, hiding empty SVG files inside HTML attachments pretending to be DocuSign documents. Security researchers have named it "Blank Image." They explained that the attack allows phishing actors to evade detection of redirect URLs.

See the full report here: https://www.bleepingcomputer.com/news/security/new-blank-image-attack-hides-phishing-scripts-in-svg-files/

PayPal accounts breached in large-scale credential stuffing attack

PayPal is sending out data breach notifications to thousands of users who had their accounts accessed through credential stuffing attacks. PayPal stated that the credential stuffing attack occurred between December 6 and December 8, 2022 and hackers had access to full names, dates of birth, postal addresses, social security numbers, and individual tax identification numbers of 34,942 users. Credential stuffing are attacks where hackers attempt to access an account by trying out username and password pairs sourced from data leaks on various websites.

See the full report here: https://www.bleepingcomputer.com/news/security/paypal-accounts-breached-in-large-scale-credential-stuffing-attack/

Exploit released for critical ManageEngine RCE bug, patch now

Proof-of-concept exploit code is now available for a remote code execution (RCE) vulnerability in multiple Zoho ManageEngine products. This pre-authentication RCE flaw is tracked as CVE-2022-47966 and stems from using an outdated and vulnerable version of the Apache Santuario library. Unauthenticated threat actors can execute arbitrary code on ManageEngine instances following successful exploitation if the SAML-based single-sign-on (SSO) is or was enabled at least once before the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-critical-manageengine-rce-bug-patch-now/

Roaming Mantis’ Android malware adds DNS changer to hack WiFi routers

The Roaming Mantis malware distribution campaign has updated its Android malware to include a DNS changer that modifies DNS settings on vulnerable WiFi routers to spread the infection to other devices. Starting in September 2022, researchers observed the Roaming Mantis credential theft and malware distribution campaign using a new version of the Wroba.o/XLoader Android malware that detects vulnerable WiFi routers based on their model and changes their DNS.

See the full report here: https://www.bleepingcomputer.com/news/security/roaming-mantis-android-malware-adds-dns-changer-to-hack-wifi-routers/

Ransomware gang steals data from KFC, Taco Bell, and Pizza Hut brand owner

Yum! Brands, the fast food brand operator of KFC, Pizza Hut, Taco Bell, and The Habit Burger Grill fast-food restaurant chains, has been targeted by a ransomware attack that forced the closure of 300 locations in the United Kingdom. Yum! Brands has confirmed that data was stolen in the attack but sees no evidence that customer information has been exposed. Yum! Brands operates 53,000 restaurants across 155 countries and territories.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-gang-steals-data-from-kfc-taco-bell-and-pizza-hut-brand-owner/

T-Mobile hacked to steal data of 37 million accounts in API data breach

T-Mobile disclosed a new data breach after a threat actor stole the personal information of 37 million current postpaid and prepaid customer accounts through one of its Application Programming Interfaces (APIs). The company described the data stolen in this attack as "basic customer information" in a separate press release.

See the full report here: https://www.bleepingcomputer.com/news/security/t-mobile-hacked-to-steal-data-of-37-million-accounts-in-api-data-breach/

New "Hook" Android malware lets hackers remotely control your phone

A new Android malware named "Hook" is being sold by cybercriminals claiming that it can remotely take over mobile devices in real-time using VNC (virtual network computing). The new malware is promoted by the creator of Ermac, an Android banking trojan selling for USD 5,000 per month that helps threat actors steal credentials from over 467 banking and crypto apps via overlaid login pages.

See the full report here: https://www.bleepingcomputer.com/news/security/new-hook-android-malware-lets-hackers-remotely-control-your-phone/

QUT confirms personal data of thousands of staff compromised in cyber attack

Thousands of staff and 67 students at the Queensland University of Technology had their personal data compromised in a cyber attack. About 2,500 current staff and a number of former staff at the state's second-largest university have had personal data stolen, which could be used in identity theft. As for students, 17 current and 50 former students have been affected.

See the full report here: https://www.abc.net.au/news/2023-01-20/qld-qut-staff-data-compromised-cyber-attack-students/101876836

Olympic legend Usain Bolt lost USD 12 million in savings to a scam.

Jamaican Olympic sprinter Usain Bolt discovered USD 12 million missing from an account he had with Kingston-based investment firm Stocks and Securities. Jamaica’s Financial Services Commission reportedly installed its own temporary manager, following reports of allegations of fraud that had earlier prompted the commission to put the bank under enhanced oversight.

See the full report here: https://fortune.com/2023/01/18/usain-bolt-scam-bank-jamaica-12-million-savings-lost-olympic-gold-sprinter/

New Boldmove Linux malware used to backdoor Fortinet devices

Suspected Chinese hackers exploited a recently disclosed FortiOS SSL-VPN vulnerability as a zeo-day, which targeted a European government and an African MSP. The vulnerability is tracked as CVE-2022-42475 and was quietly fixed by Fortinet in November 2022. Fortinet publicly disclosed the vulnerability in December 2022, urging customers to patch their devices as threat actors were actively exploiting the flaw.

See the full report here: https://www.bleepingcomputer.com/news/security/new-boldmove-linux-malware-used-to-backdoor-fortinet-devices/

LAUSD says Vice Society ransomware gang stole contractors’ SSNs

Los Angeles Unified School District (LAUSD), the second-largest school district in the United States, says the Vice Society ransomware gang has stolen files containing contractors' personal information, including Social Security Numbers (SSNs). LAUSD also revealed that the threat actors were active in its network for over two months, between July 31, 2022, and September 3, 2022.

See the full report here: https://www.bleepingcomputer.com/news/security/lausd-says-vice-society-ransomware-gang-stole-contractors-ssns/

Critical ManageEngine RCE bug now exploited to open reverse shells

A critical remote code execution (RCE) vulnerability affecting multiple Zoho ManageEngine products is now being exploited in attacks. The vulnerability, CVE-2022-47966, is a pre-authentication remote code execution (RCE) vulnerability impacting at least 24 on-premise ManageEngine products.

See the full report here: https://www.bleepingcomputer.com/news/security/critical-manageengine-rce-bug-now-exploited-to-open-reverse-shells/

Exploits released for two Samsung Galaxy App Store vulnerabilities

Two vulnerabilities in the Galaxy App Store, Samsung’s official repository for its devices, could enable attackers to install any app in the Galaxy Store without the user’s knowledge or to direct victims to a malicious web location. The issues were discovered by researchers between November 23 and December 3, 2022. Samsung announced on January 1, 2023 that it fixed the two flaws and released a new version for Galaxy App Store (4.5.49.8).

See the full report here: https://www.bleepingcomputer.com/news/security/exploits-released-for-two-samsung-galaxy-app-store-vulnerabilities/

Over 19,000 end-of-life Cisco routers exposed to RCE attacks

Over 19,000 end-of-life Cisco VPN routers on the Internet are exposed to attacks targeting a remote command execution exploit chain. By chaining two disclosed security flaws , threat actors can bypass authentication (CVE-2023-20025) and execute arbitrary commands (CVE-2023-2002) on the underlying operating system of Cisco Small Business RV016, RV042, RV042G, and RV082 routers.

See the full report here: https://www.bleepingcomputer.com/news/security/over-19-000-end-of-life-cisco-routers-exposed-to-rce-attacks/

Massive ad-fraud op dismantled after hitting millions of iOS devices

A massive ad fraud operation dubbed "Vastflux" that spoofed more than 1,700 applications from 120 publishers, mostly for iOS, has been disrupted by security researchers. The operation's name was derived from the VAST ad-serving template and the "fast flux" evasion technique used to conceal malicious code by rapidly changing a large number of IP addresses and DNS records associated with a single domain.

See the full report here: https://www.bleepingcomputer.com/news/security/massive-ad-fraud-op-dismantled-after-hitting-millions-of-ios-devices/

Hackers now use Microsoft OneNote attachments to spread malware

Threat actors now use OneNote attachments in phishing emails that infect victims with remote access malware which can be used to install further malware, steal passwords, or even cryptocurrency wallets. This comes after attackers have been distributing malware in emails using malicious Word and Excel attachments that launch macros to download and install malware for years.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/

WhatsApp fined EUR 5.5 million by Irish DPC for GDPR violation

The Irish Data Protection Commission (DPC) has fined WhatsApp Ireland EUR 5.5 million after confirming that the messaging service violated the General Data Protection Regulation (GDPR). The authority has ordered WhatsApp to bring its data processing operations into compliance within six months, or it faces a new fine.

See the full report here: https://thehackernews.com/2023/01/whatsapp-hit-with-55-million-fine-for.html

FanDuels warns of data breach after customer info stolen in vendor hack

The FanDuel sportsbook and betting site is warning customers that their names and email addresses were exposed in a January 2023 MailChimp security breach, urging users to remain vigilant against phishing emails. On January 13, MailChimp confirmed that it suffered a breach after hackers stole an employee's credentials using a social engineering attack. Using these credentials, the threat actors accessed an internal MailChimp customer support and administration tool to steal the "audience data" for 133 customers.

See the full report here: https://www.bleepingcomputer.com/news/security/fanduels-warns-of-data-breach-after-customer-info-stolen-in-vendor-hack/

Riot Games hacked, delays game patches after security breach

Riot Games, the video game developer and publisher behind League of Legends and Valorant, says it will delay game patches after its development environment was compromised. The game publisher disclosed the incident in a Twitter thread and promised to keep customers up-to-date with the results of an on-going investigation.

See the full report here: https://www.bleepingcomputer.com/news/security/riot-games-hacked-delays-game-patches-after-security-breach/

New Microsoft Azure Vulnerability Uncovered — EmojiDeploy for RCE Attacks

A new critical remote code execution (RCE) flaw discovered impacting multiple services related to Microsoft Azure could be exploited by a malicious actor to completely take control of a targeted application. The vulnerability is achieved through CSRF (cross-site request forgery) on the ubiquitous SCM service Kudu. By abusing the vulnerability, attackers can deploy malicious ZIP files containing a payload to the victim's Azure application.

See the full report here: https://thehackernews.com/2023/01/new-microsoft-azure-vulnerability.html

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram

The Russian state-sponsored cyber espionage group known as Gamaredon has continued its digital onslaught against Ukraine, with recent attacks leveraging the popular messaging app Telegram to strike military and law enforcement sectors in the country.

See the full report here: https://thehackernews.com/2023/01/gamaredon-group-launches-cyberattacks.html

U.S. lawmaker indicates Congress will investigate TSA no-fly list breach

A member of the House Homeland Security Committee indicated that the U.S. Congress would investigate the data exposure of the entire U.S. no-fly list. The data was sitting on the public internet in an unsecured computer server hosted by CommuteAir, a regional airline based in Ohio, according to the hacker claiming the discovery. The regional airline said in a statement that the data accessed by the hacker was “an outdated 2019 version of the federal no-fly list” that included names and birthdates. The no-fly list is a set of known, or suspected, terrorists, who are barred from flying to or in the US.

See the full report here: https://edition.cnn.com/2023/01/21/politics/congress-dan-bishop-investigate-tsa-no-fly-list-breach/index.html

Microsoft plans to kill malware delivery via Excel XLL add-ins

Microsoft is working on adding XLL add-in protection for Microsoft 365 customers by including automated blocking of all such files downloaded from the Internet. This will help tackle the rise of malware campaigns abusing this infection vector to an ever-growing extent during the last several years.

See the full report here: https://www.bleepingcomputer.com/news/microsoft/microsoft-plans-to-kill-malware-delivery-via-excel-xll-add-ins/

GTA Online bug exploited to ban, corrupt players’ accounts

Grand Theft Auto (GTA) Online players report losing game progress, in-game money being stolen, and being banned from game servers due to an alleged vulnerability in the game. Reportedly, a new "remote code execution" vulnerability in the PC game client was abused by the developer of the "North" Grand Theft Auto V cheat to remotely change player's account attributes, corrupt accounts, and even ban players from the game.

See the full report here: https://www.bleepingcomputer.com/news/security/gta-online-bug-exploited-to-ban-corrupt-players-accounts/

Russia’s largest ISP says 2022 broke all DDoS attack records

Russia's largest internet service provider Rostelecom says 2022 was a record year for Distributed denial of service attacks (DDoS) targeting organizations in the country.

See the full report here: https://www.bleepingcomputer.com/news/security/russia-s-largest-isp-says-2022-broke-all-ddos-attack-records/

Apple fixes actively exploited iOS zero-day on older iPhones, iPads

Apple has backported security patches addressing a remotely exploitable zero-day vulnerability to older iPhones and iPads. This bug is tracked as CVE-2022-42856, and it stems from a type confusion weakness in Apple's Webkit web browser browsing engine, which allows maliciously crafted webpages to perform arbitrary code execution on vulnerable devices.

See the full report here: https://www.bleepingcomputer.com/news/apple/apple-fixes-actively-exploited-ios-zero-day-on-older-iphones-ipads/

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks

The legitimate command-and-control (C2) framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit. Sliver is a Golang-based cross-platform post-exploitation framework that is designed to be used by security professionals in their red team operations.

See the full report here: https://thehackernews.com/2023/01/threat-actors-turn-to-sliver-as-open.html

International Cricket Council becomes victim of online fraud

A recent scam has struck members of the International Cricket Council and involved the theft of close to USD 2.5 million. The matter is being investigated internally and externally with ICC's finance department coming under sharp focus on issues relating to due diligence and release of payment four times.

See the full report here: https://m.timesofindia.com/sports/cricket/news/the-menace-of-online-fraud-now-the-icc-becomes-a-victim/articleshow/97167561.cms

FBI: North Korean Hackers Behind USD 100 Million Horizon Bridge Theft

North Korean hacker groups were reportedly behind the June 2022 theft of USD 100 million in crypto assets from Horizon Bridge, the Federal Bureau of Investigation (FBI) said in a statement. The FBI said that the hackers relied on a malware campaign known as “TraderTraitor” in the Harmony attack. U.S. authorities said that North Korea’s thefts of crypto and laundering of the assets are used to support North Korea’s ballistic missile and Weapons of Mass Destruction programs.

See the full report here: https://www.coindesk.com/policy/2023/01/23/fbi-north-korean-hackers-behind-100-million-horizon-bridge-theft/

Ministry of External Affairs e-mail server hacked

The Ministry of External Affairs, India, has reportedly confirmed a recent security breach after a hacker breached the email server of the ministry. Confidential emails of the foreign ministry are now available for sale on the dark web, according to reports. The e-mail IDs and passwords of at least 15 senior officials of the ministry have been leaked on the dark web. The foreign ministry data is available for sale at a price between USD 7,355 and USD 26,960. The Central agencies have launched a detailed probe in the case.

See the full report here: https://zeenews.india.com/india/dna-exclusive-mea-e-mail-server-hacked-biggest-ever-cyber-attack-in-india-2565072.html

Ransomware access brokers use Google ads to breach your network

A threat actor tracked as DEV-0569 uses Google Ads in widespread, ongoing advertising campaigns to distribute malware, steal victims' passwords, and ultimately breach networks for ransomware attacks. Clicking on the ads leads visitors to sites that appear as download portals or replicas of the software's legitimate sites.

See the full report here: https://www.bleepingcomputer.com/news/security/ransomware-access-brokers-use-google-ads-to-breach-your-network/

VMware fixes critical security bugs in vRealize log analysis tool

VMware has released security patches to address vRealize Log Insight vulnerabilities that could enable attackers to gain remote execution on unpatched appliances. vRealize Log Insight (now known as VMware Aria Operations for Logs) is a log analysis and management tool that helps analyze terabytes of infrastructure and application logs in VMware environments. The company said the vulnerabilities were addressed with VMware vRealize Log Insight 8.10.2. None of the security bugs addressed were tagged as being exploited in the wild.

See the full report here: https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-security-bugs-in-vrealize-log-analysis-tool/

U.S. sues Google for abusing dominance over online ad market

The U.S. Justice Department has filed a federal lawsuit against Google for abusing its dominant position in the online advertising market. The DOJ was also joined by eight states: Virginia, California, Colorado, Connecticut, New Jersey, New York, Rhode Island, and Tennessee.

See the full report here: https://www.bleepingcomputer.com/news/security/us-sues-google-for-abusing-dominance-over-online-ad-market/

Riot Games receives ransom demand from hackers, refuses to pay

Riot Games announced that it will not pay a USD 10 million ransom demanded by attackers who stole League of Legends source code in a recent security breach. The threat actors stole source code for the League of Legends (LoL) multiplayer online battle arena, the Teamfight Tactics (TFT) auto battler game, and a legacy anti-cheat platform. The company is analysing how cheat developers could use the stolen data to create new tools and determining if any fixes are needed to fend off such malicious efforts.

See the full report here: https://www.bleepingcomputer.com/news/security/riot-games-receives-ransom-demand-from-hackers-refuses-to-pay/

75,000 WordPress sites impacted by critical online course plugin flaws

The WordPress online course plugin "LearnPress" was vulnerable to multiple critical-severity flaws, including pre-auth SQL injection and local file inclusion. The vulnerabilities in the plugin, used in over 100,000 active sites, were fixed on December 20, 2022, with the release of LearnPress version 4.2.0.

See the full report here: https://www.bleepingcomputer.com/news/security/75k-wordpress-sites-impacted-by-critical-online-course-plugin-flaws/

GoTo says hackers stole customers' backups and encryption key

GoTo is warning customers that threat actors who breached its development environment in November 2022 stole encrypted backups containing customer information and an encryption key for a portion of that data. GoTo provides a platform for cloud-based remote working, collaboration, and communication, as well as remote IT management and technical support solutions.

See the full report here: https://www.bleepingcomputer.com/news/security/goto-says-hackers-stole-customers-backups-and-encryption-key/

Zendesk Hacked After Employees Fall for Phishing Attack

Customer service solutions provider Zendesk has reportedly suffered a data breach that resulted from employee account credentials getting phished by hackers. Zendesk learned on October 25, 2022, that several employees were targeted in a SMS phishing campaign.

See the full report here: https://www.securityweek.com/zendesk-hacked-after-employees-fall-for-phishing-attack/

Emotet Malware Makes a Comeback with New Evasion Techniques

The Emotet malware operation has continued to refine its tactics in an effort to fly under the radar, while also acting as a conduit for other malware such as Bumblebee and IcedID. Two latest additions to Emotet's module arsenal comprise an SMB spreader designed to facilitate lateral movement using a list of hard-coded usernames and passwords, and a credit card stealer that targets the Chrome web browser.

See the full report here: https://thehackernews.com/2023/01/emotet-malware-makes-comeback-with-new.html

North Korean Hackers Turn to Credential Harvesting in Latest Wave of Cyberattacks

A North Korean nation-state group (known as TA444, APT38, BlueNoroff, Copernicium, or Stardust Chollima) has been attributed to a new wave of malicious email attacks as part of a massive credential harvesting campaign. The group’s operations are financially motivated and geared towards generating illicit revenue for North Korea as opposed to espionage and data theft.

See the full report here: https://thehackernews.com/2023/01/north-korean-hackers-turn-to-credential.html

Exploit released for critical Windows CryptoAPI spoofing bug

Proof of concept exploit code has been released for a critical Windows CryptoAPI vulnerability (CVE-2022-34689) discovered by the NSA and U.K.'s NCSC allowing MD5-collision certificate spoofing. This security flaw was addressed with security updates released in August 2022. The bug could also provide attackers with the ability to perform man-in-the-middle attacks and decrypt confidential information on user connections to the affected software, such as web browsers that use Windows' CryptoAPI cryptography library.

See the full report here: https://www.bleepingcomputer.com/news/security/exploit-released-for-critical-windows-cryptoapi-spoofing-bug/

CISA: Federal agencies hacked using legitimate remote desktop tools

CISA, the NSA, and MS-ISAC issued a joint advisory stating that attackers are increasingly using legitimate remote monitoring and management (RMM) software for malicious purposes. To protect against potential security breaches, companies and organizations should audit installed remote access tools, identify authorized RMM software, and implement training programs and phishing exercises.

See the full report here: https://www.bleepingcomputer.com/news/security/cisa-federal-agencies-hacked-using-legitimate-remote-desktop-tools/

Hackers auction alleged source code for League of Legends

Threat actors are auctioning the alleged source code for Riot Game's League of Legends and the Packman anti-cheat software, confirmed to be stolen in a recent hack of the game company's developer environment. The threat actors stated they gained access to Riot Game's network after performing a social engineering attack over SMS on one of the company's employees.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-auction-alleged-source-code-for-league-of-legends/

Zacks Investment Research data breach affects 820,000 clients

Hackers breached Zacks Investment Research (Zacks) company last year and gained access to personal and sensitive information belonging to 820,000 customers. It is unclear if any data was stolen but the information exposed during the breach includes full names, addresses, phone numbers, email addresses, and user passwords for the firm’s website. Zacks has initiated the password reset procedure for compromised accounts.

See the full report here: https://www.bleepingcomputer.com/news/security/zacks-investment-research-data-breach-affects-820-000-clients/

Malware exploited critical Realtek SDK bug in millions of attacks

Hackers have leveraged a critical remote code execution vulnerability (CVE-2021-35394) in Realtek Jungle SDK 134 million attacks trying to infect smart devices in the second half of 2022. Realtek fixed the flaw on August 15, 2021. A surge in exploiting CVE-2021-35394 more than a year after Realtek released security fixes indicates that remediation efforts are lagging.

See the full report here: https://www.bleepingcomputer.com/news/security/malware-exploited-critical-realtek-sdk-bug-in-millions-of-attacks/

New stealthy Python RAT malware targets Windows in attacks

A new Python-based malware has been spotted in the wild featuring remote access trojan (RAT) capabilities to give its operators control over the breached systems. Dubbed PY#RATION, the new RAT uses the WebSocket protocol to communicate with the command and control (C2) server and to exfiltrate data from the victim host.

See the full report here: https://www.bleepingcomputer.com/news/security/new-stealthy-python-rat-malware-targets-windows-in-attacks/